Detections
Analytics

Rclone 1.46.x < 1.74.3 Unauthenticated Command Execution

critical Nessus Plugin ID 321508

Synopsis

An application installed on the remote host is affected by an unauthenticated command execution vulnerability.

Description

The version of Rclone installed on the remote host is 1.46.x prior to 1.74.3. It is, therefore, affected by an unauthenticated command execution vulnerability:

 - rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. (CVE-2026-49980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Rclone version 1.74.3 or later.

See Also

http://www.nessus.org/u?8128551c

Plugin Details

Severity: Critical

ID: 321508

File Name: rclone_CVE-2026-49980.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 6/18/2026

Updated: 6/18/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-49980

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:rclone:rclone

Required KB Items: installed_sw/rclone

Patch Publication Date: 6/5/2026

Vulnerability Publication Date: 6/5/2026

Reference Information

CVE: CVE-2026-49980